安全扫描工具指南：Nmap、Nessus等网络漏洞扫描与渗透测试工具

scanning-tools by sickn33/antigravity-awesome-skills

215 周安装量

30,400 GitHub Stars

GitHub

安装命令

npx skills add https://github.com/sickn33/antigravity-awesome-skills --skill scanning-tools

网络协议分析测试安全

🇨🇳中文介绍

安全扫描工具

目的

掌握用于网络发现、漏洞评估、Web 应用程序测试、无线安全和合规性验证的基本安全扫描工具。此技能涵盖不同扫描类别中的工具选择、配置和实际使用。

先决条件

所需环境

基于 Linux 的系统（推荐 Kali Linux）
对目标系统的网络访问权限
扫描活动的适当授权

所需知识

基本网络概念（TCP/IP、端口、协议）
对常见漏洞的理解
熟悉命令行界面

输出和交付成果

网络发现报告 - 已识别的主机、端口和服务
漏洞评估报告 - CVE、错误配置、风险评级
Web 应用程序安全报告 - OWASP Top 10 发现项
合规性报告 - CIS 基准、PCI-DSS、HIPAA 检查

核心工作流程

阶段 1：网络扫描工具

Nmap（网络映射器）

用于网络发现和安全审计的主要工具：

# Host discovery
nmap -sn 192.168.1.0/24              # Ping scan (no port scan)
nmap -sL 192.168.1.0/24              # List scan (DNS resolution)
nmap -Pn 192.168.1.100               # Skip host discovery

# Port scanning techniques
nmap -sS 192.168.1.100               # TCP SYN scan (stealth)
nmap -sT 192.168.1.100               # TCP connect scan
nmap -sU 192.168.1.100               # UDP scan
nmap -sA 192.168.1.100               # ACK scan (firewall detection)

# Port specification
nmap -p 80,443 192.168.1.100         # Specific ports
nmap -p- 192.168.1.100               # All 65535 ports
nmap -p 1-1000 192.168.1.100         # Port range
nmap --top-ports 100 192.168.1.100   # Top 100 common ports

# Service and OS detection
nmap -sV 192.168.1.100               # Service version detection
nmap -O 192.168.1.100                # OS detection
nmap -A 192.168.1.100                # Aggressive (OS, version, scripts)

# Timing and performance
nmap -T0 192.168.1.100               # Paranoid (slowest, IDS evasion)
nmap -T4 192.168.1.100               # Aggressive (faster)
nmap -T5 192.168.1.100               # Insane (fastest)

# NSE Scripts
nmap --script=vuln 192.168.1.100     # Vulnerability scripts
nmap --script=http-enum 192.168.1.100  # Web enumeration
nmap --script=smb-vuln* 192.168.1.100  # SMB vulnerabilities
nmap --script=default 192.168.1.100  # Default script set

# Output formats
nmap -oN scan.txt 192.168.1.100      # Normal output
nmap -oX scan.xml 192.168.1.100      # XML output
nmap -oG scan.gnmap 192.168.1.100    # Grepable output
nmap -oA scan 192.168.1.100          # All formats

广告位招租

在这里展示您的产品或服务

触达数万 AI 开发者，精准高效

联系我们

阶段 2：漏洞扫描工具

企业级漏洞评估：

# Start Nessus service
sudo systemctl start nessusd

# Access web interface
# https://localhost:8834

# Command-line (nessuscli)
nessuscli scan --create --name "Internal Scan" --targets 192.168.1.0/24
nessuscli scan --list
nessuscli scan --launch <scan_id>
nessuscli report --format pdf --output report.pdf <scan_id>

Nessus 关键特性：

全面的 CVE 检测
合规性检查（PCI-DSS、HIPAA、CIS）
自定义扫描模板
凭证扫描以进行更深入的分析
定期的插件更新

OpenVAS（Greenbone）

开源漏洞扫描：

# Install OpenVAS
sudo apt install openvas
sudo gvm-setup

# Start services
sudo gvm-start

# Access web interface (Greenbone Security Assistant)
# https://localhost:9392

# Command-line operations
gvm-cli socket --xml "<get_version/>"
gvm-cli socket --xml "<get_tasks/>"

# Create and run scan
gvm-cli socket --xml '
<create_target>
  <name>Test Target</name>
  <hosts>192.168.1.0/24</hosts>
</create_target>'

阶段 3：Web 应用程序扫描工具

全面的 Web 应用程序测试：

# Proxy configuration
1. Set browser proxy to 127.0.0.1:8080
2. Import Burp CA certificate for HTTPS
3. Add target to scope

# Key modules:
- Proxy: Intercept and modify requests
- Spider: Crawl web applications
- Scanner: Automated vulnerability detection
- Intruder: Automated attacks (fuzzing, brute-force)
- Repeater: Manual request manipulation
- Decoder: Encode/decode data
- Comparer: Compare responses

核心测试工作流程：

配置代理和范围
爬取应用程序
分析站点地图
运行主动扫描器
使用 Repeater/Intruder 进行手动测试
审查发现项并生成报告

开源 Web 应用程序扫描器：

# Start ZAP
zaproxy

# Automated scan from CLI
zap-cli quick-scan https://target.com

# Full scan
zap-cli spider https://target.com
zap-cli active-scan https://target.com

# Generate report
zap-cli report -o report.html -f html

# API mode
zap.sh -daemon -port 8080 -config api.key=<your_key>

# Docker-based scanning
docker run -t owasp/zap2docker-stable zap-full-scan.py \
  -t https://target.com -r report.html

# Baseline scan (passive only)
docker run -t owasp/zap2docker-stable zap-baseline.py \
  -t https://target.com -r report.html

Web 服务器漏洞扫描器：

# Basic scan
nikto -h https://target.com

# Scan specific port
nikto -h target.com -p 8080

# Scan with SSL
nikto -h target.com -ssl

# Multiple targets
nikto -h targets.txt

# Output formats
nikto -h target.com -o report.html -Format html
nikto -h target.com -o report.xml -Format xml
nikto -h target.com -o report.csv -Format csv

# Tuning options
nikto -h target.com -Tuning 123456789  # All tests
nikto -h target.com -Tuning x          # Exclude specific tests

阶段 4：无线扫描工具

无线网络渗透测试：

# Check wireless interface
airmon-ng

# Enable monitor mode
sudo airmon-ng start wlan0

# Scan for networks
sudo airodump-ng wlan0mon

# Capture specific network
sudo airodump-ng -c <channel> --bssid <target_bssid> -w capture wlan0mon

# Deauthentication attack
sudo aireplay-ng -0 10 -a <bssid> wlan0mon

# Crack WPA handshake
aircrack-ng -w wordlist.txt -b <bssid> capture*.cap

# Crack WEP
aircrack-ng -b <bssid> capture*.cap

被动无线检测：

# Start Kismet
kismet

# Specify interface
kismet -c wlan0

# Access web interface
# http://localhost:2501

# Detect hidden networks
# Kismet passively collects all beacon frames
# including those from hidden SSIDs

阶段 5：恶意软件和漏洞利用扫描

开源防病毒扫描：

# Update virus definitions
sudo freshclam

# Scan directory
clamscan -r /path/to/scan

# Scan with verbose output
clamscan -r -v /path/to/scan

# Move infected files
clamscan -r --move=/quarantine /path/to/scan

# Remove infected files
clamscan -r --remove /path/to/scan

# Scan specific file types
clamscan -r --include='\.exe$|\.dll$' /path/to/scan

# Output to log
clamscan -r -l scan.log /path/to/scan

Metasploit 漏洞验证

通过漏洞利用验证漏洞：

# Start Metasploit
msfconsole

# Database setup
msfdb init
db_status

# Import Nmap results
db_import /path/to/nmap_scan.xml

# Vulnerability scanning
use auxiliary/scanner/smb/smb_ms17_010
set RHOSTS 192.168.1.0/24
run

# Auto exploitation
vulns                           # View vulnerabilities
analyze                         # Suggest exploits

阶段 6：云安全扫描

# Install Prowler
pip install prowler

# Basic scan
prowler aws

# Specific checks
prowler aws -c iam s3 ec2

# Compliance framework
prowler aws --compliance cis_aws

# Output formats
prowler aws -M html json csv

# Specific region
prowler aws -f us-east-1

# Assume role
prowler aws -R arn:aws:iam::123456789012:role/ProwlerRole

ScoutSuite（多云）

多云安全审计：

# Install ScoutSuite
pip install scoutsuite

# AWS scan
scout aws

# Azure scan
scout azure --cli

# GCP scan
scout gcp --user-account

# Generate report
scout aws --report-dir ./reports

阶段 7：合规性扫描

Unix/Linux 安全审计：

# Run audit
sudo lynis audit system

# Quick scan
sudo lynis audit system --quick

# Specific profile
sudo lynis audit system --profile server

# Output report
sudo lynis audit system --report-file /tmp/lynis-report.dat

# Check specific section
sudo lynis show profiles
sudo lynis audit system --tests-from-group malware

安全合规性扫描：

# List available profiles
oscap info /usr/share/xml/scap/ssg/content/ssg-<distro>-ds.xml

# Run scan with profile
oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_pci-dss \
  --report report.html \
  /usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml

# Generate fix script
oscap xccdf generate fix \
  --profile xccdf_org.ssgproject.content_profile_pci-dss \
  --output remediation.sh \
  /usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml

阶段 8：扫描方法论

结构化的扫描方法：

规划
- 定义范围和目标
- 获得适当的授权
- 选择合适的工具
发现
- 主机发现（Nmap ping 扫描）
- 端口扫描
- 服务枚举
漏洞评估
- 自动扫描（Nessus/OpenVAS）
- Web 应用程序扫描（Burp/ZAP）
- 手动验证
分析
- 关联发现项
- 消除误报
- 按严重性排序
报告
- 记录发现项
- 提供修复指导
- 执行摘要

阶段 9：工具选择指南

为每种场景选择合适的工具：

场景	推荐工具
网络发现	Nmap, Masscan
漏洞评估	Nessus, OpenVAS
Web 应用程序测试	Burp Suite, ZAP, Nikto
无线安全	Aircrack-ng, Kismet
恶意软件检测	ClamAV, YARA
云安全	Prowler, ScoutSuite
合规性	Lynis, OpenSCAP
协议分析	Wireshark, tcpdump

阶段 10：报告和文档

生成专业报告：

# Nmap XML to HTML
xsltproc nmap-output.xml -o report.html

# OpenVAS report export
gvm-cli socket --xml '<get_reports report_id="<id>" format_id="<pdf_format>"/>'

# Combine multiple scan results
# Use tools like Faraday, Dradis, or custom scripts

# Executive summary template:
# 1. Scope and methodology
# 2. Key findings summary
# 3. Risk distribution chart
# 4. Critical vulnerabilities
# 5. Remediation recommendations
# 6. Detailed technical findings

扫描类型	命令
Ping 扫描	`nmap -sn <target>`
快速扫描	`nmap -T4 -F <target>`
完整扫描	`nmap -p- <target>`
服务扫描	`nmap -sV <target>`
操作系统检测	`nmap -O <target>`
主动扫描	`nmap -A <target>`
漏洞脚本	`nmap --script=vuln <target>`
隐蔽扫描	`nmap -sS -T2 <target>`

端口	服务
21	FTP
22	SSH
23	Telnet
25	SMTP
53	DNS
80	HTTP
443	HTTPS
445	SMB
3306	MySQL
3389	RDP

始终获得书面授权
尊重范围边界
遵循负责任的披露实践
遵守当地法律和法规

某些扫描可能触发 IDS/IPS 警报
大量扫描可能影响网络性能
误报需要手动验证
加密流量可能限制分析

从非侵入式扫描开始
逐渐增加扫描强度
记录所有扫描活动
在报告前验证发现项

扫描未检测到主机

尝试不同的发现方法：nmap -Pn 或 nmap -sn -PS/PA/PU
检查防火墙规则是否阻止 ICMP
使用 TCP SYN 扫描：nmap -PS22,80,443
验证网络连接

增加定时参数：nmap -T4 或 -T5
减少端口范围：--top-ports 100
使用 Masscan 进行初始发现
禁用 DNS 解析：-n

Web 扫描器遗漏漏洞

进行身份验证以访问受保护区域
增加爬取深度
添加自定义注入点
使用多种工具以确保覆盖范围
执行手动测试

此技能适用于执行概述中描述的工作流程或操作。

2026 年 2 月 21 日

🇺🇸English

Security Scanning Tools

Purpose

Master essential security scanning tools for network discovery, vulnerability assessment, web application testing, wireless security, and compliance validation. This skill covers tool selection, configuration, and practical usage across different scanning categories.

Prerequisites

Required Environment

Linux-based system (Kali Linux recommended)
Network access to target systems
Proper authorization for scanning activities

Required Knowledge

Basic networking concepts (TCP/IP, ports, protocols)
Understanding of common vulnerabilities
Familiarity with command-line interfaces

Outputs and Deliverables

Network Discovery Reports - Identified hosts, ports, and services
Vulnerability Assessment Reports - CVEs, misconfigurations, risk ratings
Web Application Security Reports - OWASP Top 10 findings
Compliance Reports - CIS benchmarks, PCI-DSS, HIPAA checks

Core Workflow

Phase 1: Network Scanning Tools

Nmap (Network Mapper)

Primary tool for network discovery and security auditing:

# Host discovery
nmap -sn 192.168.1.0/24              # Ping scan (no port scan)
nmap -sL 192.168.1.0/24              # List scan (DNS resolution)
nmap -Pn 192.168.1.100               # Skip host discovery

# Port scanning techniques
nmap -sS 192.168.1.100               # TCP SYN scan (stealth)
nmap -sT 192.168.1.100               # TCP connect scan
nmap -sU 192.168.1.100               # UDP scan
nmap -sA 192.168.1.100               # ACK scan (firewall detection)

# Port specification
nmap -p 80,443 192.168.1.100         # Specific ports
nmap -p- 192.168.1.100               # All 65535 ports
nmap -p 1-1000 192.168.1.100         # Port range
nmap --top-ports 100 192.168.1.100   # Top 100 common ports

# Service and OS detection
nmap -sV 192.168.1.100               # Service version detection
nmap -O 192.168.1.100                # OS detection
nmap -A 192.168.1.100                # Aggressive (OS, version, scripts)

# Timing and performance
nmap -T0 192.168.1.100               # Paranoid (slowest, IDS evasion)
nmap -T4 192.168.1.100               # Aggressive (faster)
nmap -T5 192.168.1.100               # Insane (fastest)

# NSE Scripts
nmap --script=vuln 192.168.1.100     # Vulnerability scripts
nmap --script=http-enum 192.168.1.100  # Web enumeration
nmap --script=smb-vuln* 192.168.1.100  # SMB vulnerabilities
nmap --script=default 192.168.1.100  # Default script set

# Output formats
nmap -oN scan.txt 192.168.1.100      # Normal output
nmap -oX scan.xml 192.168.1.100      # XML output
nmap -oG scan.gnmap 192.168.1.100    # Grepable output
nmap -oA scan 192.168.1.100          # All formats

Masscan

High-speed port scanning for large networks:

# Basic scanning
masscan -p80 192.168.1.0/24 --rate=1000
masscan -p80,443,8080 192.168.1.0/24 --rate=10000

# Full port range
masscan -p0-65535 192.168.1.0/24 --rate=5000

# Large-scale scanning
masscan 0.0.0.0/0 -p443 --rate=100000 --excludefile exclude.txt

# Output formats
masscan -p80 192.168.1.0/24 -oG results.gnmap
masscan -p80 192.168.1.0/24 -oJ results.json
masscan -p80 192.168.1.0/24 -oX results.xml

# Banner grabbing
masscan -p80 192.168.1.0/24 --banners

Phase 2: Vulnerability Scanning Tools

Nessus

Enterprise-grade vulnerability assessment:

# Start Nessus service
sudo systemctl start nessusd

# Access web interface
# https://localhost:8834

# Command-line (nessuscli)
nessuscli scan --create --name "Internal Scan" --targets 192.168.1.0/24
nessuscli scan --list
nessuscli scan --launch <scan_id>
nessuscli report --format pdf --output report.pdf <scan_id>

Key Nessus features:

Comprehensive CVE detection
Compliance checks (PCI-DSS, HIPAA, CIS)
Custom scan templates
Credentialed scanning for deeper analysis
Regular plugin updates

OpenVAS (Greenbone)

Open-source vulnerability scanning:

# Install OpenVAS
sudo apt install openvas
sudo gvm-setup

# Start services
sudo gvm-start

# Access web interface (Greenbone Security Assistant)
# https://localhost:9392

# Command-line operations
gvm-cli socket --xml "<get_version/>"
gvm-cli socket --xml "<get_tasks/>"

# Create and run scan
gvm-cli socket --xml '
<create_target>
  <name>Test Target</name>
  <hosts>192.168.1.0/24</hosts>
</create_target>'

Phase 3: Web Application Scanning Tools

Burp Suite

Comprehensive web application testing:

# Proxy configuration
1. Set browser proxy to 127.0.0.1:8080
2. Import Burp CA certificate for HTTPS
3. Add target to scope

# Key modules:
- Proxy: Intercept and modify requests
- Spider: Crawl web applications
- Scanner: Automated vulnerability detection
- Intruder: Automated attacks (fuzzing, brute-force)
- Repeater: Manual request manipulation
- Decoder: Encode/decode data
- Comparer: Compare responses

Core testing workflow:

Configure proxy and scope
Spider the application
Analyze sitemap
Run active scanner
Manual testing with Repeater/Intruder
Review findings and generate report

OWASP ZAP

Open-source web application scanner:

# Start ZAP
zaproxy

# Automated scan from CLI
zap-cli quick-scan https://target.com

# Full scan
zap-cli spider https://target.com
zap-cli active-scan https://target.com

# Generate report
zap-cli report -o report.html -f html

# API mode
zap.sh -daemon -port 8080 -config api.key=<your_key>

ZAP automation:

# Docker-based scanning
docker run -t owasp/zap2docker-stable zap-full-scan.py \
  -t https://target.com -r report.html

# Baseline scan (passive only)
docker run -t owasp/zap2docker-stable zap-baseline.py \
  -t https://target.com -r report.html

Nikto

Web server vulnerability scanner:

# Basic scan
nikto -h https://target.com

# Scan specific port
nikto -h target.com -p 8080

# Scan with SSL
nikto -h target.com -ssl

# Multiple targets
nikto -h targets.txt

# Output formats
nikto -h target.com -o report.html -Format html
nikto -h target.com -o report.xml -Format xml
nikto -h target.com -o report.csv -Format csv

# Tuning options
nikto -h target.com -Tuning 123456789  # All tests
nikto -h target.com -Tuning x          # Exclude specific tests

Phase 4: Wireless Scanning Tools

Aircrack-ng Suite

Wireless network penetration testing:

# Check wireless interface
airmon-ng

# Enable monitor mode
sudo airmon-ng start wlan0

# Scan for networks
sudo airodump-ng wlan0mon

# Capture specific network
sudo airodump-ng -c <channel> --bssid <target_bssid> -w capture wlan0mon

# Deauthentication attack
sudo aireplay-ng -0 10 -a <bssid> wlan0mon

# Crack WPA handshake
aircrack-ng -w wordlist.txt -b <bssid> capture*.cap

# Crack WEP
aircrack-ng -b <bssid> capture*.cap

Kismet

Passive wireless detection:

# Start Kismet
kismet

# Specify interface
kismet -c wlan0

# Access web interface
# http://localhost:2501

# Detect hidden networks
# Kismet passively collects all beacon frames
# including those from hidden SSIDs

Phase 5: Malware and Exploit Scanning

ClamAV

Open-source antivirus scanning:

# Update virus definitions
sudo freshclam

# Scan directory
clamscan -r /path/to/scan

# Scan with verbose output
clamscan -r -v /path/to/scan

# Move infected files
clamscan -r --move=/quarantine /path/to/scan

# Remove infected files
clamscan -r --remove /path/to/scan

# Scan specific file types
clamscan -r --include='\.exe$|\.dll$' /path/to/scan

# Output to log
clamscan -r -l scan.log /path/to/scan

Metasploit Vulnerability Validation

Validate vulnerabilities with exploitation:

# Start Metasploit
msfconsole

# Database setup
msfdb init
db_status

# Import Nmap results
db_import /path/to/nmap_scan.xml

# Vulnerability scanning
use auxiliary/scanner/smb/smb_ms17_010
set RHOSTS 192.168.1.0/24
run

# Auto exploitation
vulns                           # View vulnerabilities
analyze                         # Suggest exploits

Phase 6: Cloud Security Scanning

Prowler (AWS)

AWS security assessment:

# Install Prowler
pip install prowler

# Basic scan
prowler aws

# Specific checks
prowler aws -c iam s3 ec2

# Compliance framework
prowler aws --compliance cis_aws

# Output formats
prowler aws -M html json csv

# Specific region
prowler aws -f us-east-1

# Assume role
prowler aws -R arn:aws:iam::123456789012:role/ProwlerRole

ScoutSuite (Multi-cloud)

Multi-cloud security auditing:

# Install ScoutSuite
pip install scoutsuite

# AWS scan
scout aws

# Azure scan
scout azure --cli

# GCP scan
scout gcp --user-account

# Generate report
scout aws --report-dir ./reports

Phase 7: Compliance Scanning

Lynis

Security auditing for Unix/Linux:

# Run audit
sudo lynis audit system

# Quick scan
sudo lynis audit system --quick

# Specific profile
sudo lynis audit system --profile server

# Output report
sudo lynis audit system --report-file /tmp/lynis-report.dat

# Check specific section
sudo lynis show profiles
sudo lynis audit system --tests-from-group malware

OpenSCAP

Security compliance scanning:

# List available profiles
oscap info /usr/share/xml/scap/ssg/content/ssg-<distro>-ds.xml

# Run scan with profile
oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_pci-dss \
  --report report.html \
  /usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml

# Generate fix script
oscap xccdf generate fix \
  --profile xccdf_org.ssgproject.content_profile_pci-dss \
  --output remediation.sh \
  /usr/share/xml/scap/ssg/content/ssg-rhel8-ds.xml

Phase 8: Scanning Methodology

Structured scanning approach:

Planning
- Define scope and objectives
- Obtain proper authorization
- Select appropriate tools
Discovery
- Host discovery (Nmap ping sweep)
- Port scanning
- Service enumeration
Vulnerability Assessment
- Automated scanning (Nessus/OpenVAS)
- Web application scanning (Burp/ZAP)
- Manual verification
Analysis
- Correlate findings
- Eliminate false positives
- Prioritize by severity
Reporting
- Document findings
- Provide remediation guidance
- Executive summary

Phase 9: Tool Selection Guide

Choose the right tool for each scenario:

Scenario	Recommended Tools
Network Discovery	Nmap, Masscan
Vulnerability Assessment	Nessus, OpenVAS
Web App Testing	Burp Suite, ZAP, Nikto
Wireless Security	Aircrack-ng, Kismet
Malware Detection	ClamAV, YARA
Cloud Security	Prowler, ScoutSuite
Compliance	Lynis, OpenSCAP
Protocol Analysis	Wireshark, tcpdump

Phase 10: Reporting and Documentation

Generate professional reports:

# Nmap XML to HTML
xsltproc nmap-output.xml -o report.html

# OpenVAS report export
gvm-cli socket --xml '<get_reports report_id="<id>" format_id="<pdf_format>"/>'

# Combine multiple scan results
# Use tools like Faraday, Dradis, or custom scripts

# Executive summary template:
# 1. Scope and methodology
# 2. Key findings summary
# 3. Risk distribution chart
# 4. Critical vulnerabilities
# 5. Remediation recommendations
# 6. Detailed technical findings

Quick Reference

Nmap Cheat Sheet

Scan Type	Command
Ping Scan	`nmap -sn <target>`
Quick Scan	`nmap -T4 -F <target>`
Full Scan	`nmap -p- <target>`
Service Scan	`nmap -sV <target>`
OS Detection	`nmap -O <target>`
Aggressive	`nmap -A <target>`

Common Ports Reference

Port	Service
21	FTP
22	SSH
23	Telnet
25	SMTP
53	DNS
80	HTTP
443	HTTPS
445	SMB
3306	MySQL
3389	RDP

Constraints and Limitations

Legal Considerations

Always obtain written authorization
Respect scope boundaries
Follow responsible disclosure practices
Comply with local laws and regulations

Technical Limitations

Some scans may trigger IDS/IPS alerts
Heavy scanning can impact network performance
False positives require manual verification
Encrypted traffic may limit analysis

Best Practices

Start with non-intrusive scans
Gradually increase scan intensity
Document all scanning activities
Validate findings before reporting

Troubleshooting

Scan Not Detecting Hosts

Solutions:

Try different discovery methods: nmap -Pn or nmap -sn -PS/PA/PU
Check firewall rules blocking ICMP
Use TCP SYN scan: nmap -PS22,80,443
Verify network connectivity

Slow Scan Performance

Solutions:

Increase timing: nmap -T4 or -T5
Reduce port range: --top-ports 100
Use Masscan for initial discovery
Disable DNS resolution: -n

Web Scanner Missing Vulnerabilities

Solutions:

Authenticate to access protected areas
Increase crawl depth
Add custom injection points
Use multiple tools for coverage
Perform manual testing

When to Use

This skill is applicable to execute the workflow or actions described in the overview.

Weekly Installs

152

Repository

sickn33/antigra…e-skills

GitHub Stars

27.4K

First Seen

Feb 21, 2026

Security Audits

Gen Agent Trust HubPass SocketWarn SnykWarn

Installed on

opencode150

codex148

github-copilot148

gemini-cli147

amp147

kimi-cli147

xdrop 文件传输脚本：Bun 环境下安全上传下载工具，支持加密分享

33,800 周安装

安全扫描工具指南：Nmap、Nessus等网络漏洞扫描与渗透测试工具

🇨🇳中文介绍

安全扫描工具

目的

先决条件

所需环境

所需知识

输出和交付成果

核心工作流程

阶段 1：网络扫描工具

Nmap（网络映射器）

相关 Skills

Masscan

阶段 2：漏洞扫描工具

Nessus

OpenVAS（Greenbone）

阶段 3：Web 应用程序扫描工具

Burp Suite

OWASP ZAP

Nikto

阶段 4：无线扫描工具

Aircrack-ng 套件

Kismet

阶段 5：恶意软件和漏洞利用扫描

ClamAV

Metasploit 漏洞验证

阶段 6：云安全扫描

Prowler（AWS）

ScoutSuite（多云）

阶段 7：合规性扫描

Lynis

OpenSCAP

阶段 8：扫描方法论

阶段 9：工具选择指南

阶段 10：报告和文档

快速参考

Nmap 速查表

常见端口参考

约束和限制

法律考虑

技术限制

最佳实践

故障排除

扫描未检测到主机

扫描性能慢

Web 扫描器遗漏漏洞

何时使用

🇺🇸English

Security Scanning Tools

Purpose

Prerequisites

Required Environment

Required Knowledge

Outputs and Deliverables

Core Workflow

Phase 1: Network Scanning Tools

Nmap (Network Mapper)

Masscan

Phase 2: Vulnerability Scanning Tools

Nessus

OpenVAS (Greenbone)

Phase 3: Web Application Scanning Tools

Burp Suite

OWASP ZAP

Nikto

Phase 4: Wireless Scanning Tools

Aircrack-ng Suite

Kismet

Phase 5: Malware and Exploit Scanning

ClamAV

Metasploit Vulnerability Validation

Phase 6: Cloud Security Scanning

Prowler (AWS)

ScoutSuite (Multi-cloud)

Phase 7: Compliance Scanning

Lynis

OpenSCAP

Phase 8: Scanning Methodology

Phase 9: Tool Selection Guide

Phase 10: Reporting and Documentation